The Interim Controller Request

Map each element of the request to a threat, then rank.

• Interim controller (four months): assuming a management role over the very area - financial reporting - that internal audit must assure. This creates a self-review threat (auditing work you performed or supervised) and a management-responsibility impairment. It is not a consulting engagement; a controller prepares records and makes decisions.
• Design and implement revenue-recognition controls: also management responsibility and self-review. Advising on control design can be acceptable; implementing it crosses the line.
• Administrative reporting to the CFO: the CFO is a key auditee; the existing reporting line already creates familiarity and intimidation exposure and weakens organizational independence.
• The chair's private comfort: one member's personal view is not a substitute for the full committee's documented judgment, and 'keeping an eye on things' is not a safeguard.

Most serious: the controller role and implementing controls, because no safeguard can restore objectivity for an audit of financial reporting controls performed by the same people who designed and operated them.

Before answering: obtain the proposed duties, duration, and reporting arrangements in writing; assess the effect on the November financial-reporting engagement; and take the matter to the full audit committee with options. The CEO's urgency should not force an answer before that.

Treat approval as permission to manage an impairment, not as removal of it.

Safeguards

• Written disclosure of the impairment to the audit committee, documented in the engagement file and in the report.
• The CAE does not audit, review, or supervise audits of financial reporting controls, revenue recognition, or any area touched by the interim work. Assurance over those areas must be overseen by someone outside internal audit (e.g., an external firm engaged by the committee).
• No preparation of original accounting records, no signing authority, no hiring or firing decisions in finance.
• A defined end date and a written return-to-audit plan, including a cooling-off period before any audit of the finance function.

Plan changes: re-scope the November financial-controls audit to be performed by an independent party or defer it with committee approval; reallocate the fourteen planned engagements against risk and available resources, with the committee explicitly accepting each deferral; document that reduced assurance is a direct consequence of the arrangement.

Reasoning: safeguards reduce the appearance problem and protect the audit from contamination, but they cannot make the CAE objective about work the CAE performed. Separation is the only real fix.

The functional line to the audit committee is right; the administrative line to the CFO is the problem. The CFO controls the audit budget, approves expenses and travel, and contributes to the CAE's performance evaluation - while also being responsible for an area internal audit must be able to criticize. That is an independence exposure in substance even if the organization chart says otherwise.

Recommend: administrative reporting to the CEO (or COO), functional reporting to the audit committee, with the committee approving the audit plan, the budget, and the CAE's appointment and removal, and meeting with the CAE without management present.

Arguments: (1) the committee cannot discharge oversight of financial reporting if the auditor's resources and standing depend on the finance executive; (2) the current crisis is the predictable result - a CFO vacancy became an audit staffing question; (3) the change costs nothing and removes a recurring governance debate; (4) it supports the expectation that internal audit has unrestricted access to the board.